On this page本页内容
Privilege actions define the operations a user can perform on a resource. 权限操作定义用户可以对资源执行的操作。A MongoDB privilege comprises a resource and the permitted actions. MongoDB权限包括资源和允许的操作。This page lists available actions grouped by common purpose.本页列出了按共同目的分组的可用操作。
MongoDB provides built-in roles with pre-defined pairings of resources and permitted actions. MongoDB通过预定义的资源配对和允许的操作提供内置角色。For lists of the actions granted, see Built-In Roles. 有关授权操作的列表，请参阅内置角色。To define custom roles, see Create a User-Defined Role.要定义自定义角色，请参阅创建用户定义的角色。
find
User can perform the following commands, and their equivalent helper methods:用户可以执行以下命令及其等效的助手方法：
aggregate for all pipeline operations except$collStats, $out, and $indexStats.$collStats、$out和$indexStats之外的所有管道操作的aggregate。checkShardingIndexcountdataSizedistinctfilemd5findgeoSearch (getLastError (getMorekillCursorslistCollectionslistIndexesmapReduce{out: inline} option.{out: inline}选项。resetError (Required for the query portion of the 输出到集合时，mapReduce command and db.collection.mapReduce() helper method when outputting to a collection.mapReduce命令的查询部分和db.collection.mapReduce()助手方法需要。
Required for the query portion of the findAndModify command and db.collection.findAndModify() helper method.findAndModify命令的查询部分和db.collection.findAndModify()助手方法需要。
Required on the source collection for the cloneCollectionAsCapped and renameCollection commands and the db.collection.renameCollection() helper method.cloneCollectionAsCapped和renameCollection命令以及db.collection.renameCollection()助手方法在源集合上是必需的。
listDatabases privilege action, users can run the listDatabases command to return a list of databases for which the user has privileges (including databases for which the user has privileges on specific collections) if the command is run with authorizedDatabases option unspecified or set to true.listDatabases权限操作，则如果在未指定authorizedDatabases选项或将其设置为true的情况下运行该命令，则用户可以运行listDatabases命令以返回用户具有权限的数据库列表（包括用户对特定集合具有权限的数据集）。listDatabases privilege action, users can run the listDatabases command to return a list of databases for which the user has the find action privilege if the command is run with authorizedDatabases option unspecified or set to true.listDatabases权限操作，则用户可以运行listDatabases命令以返回用户具有find操作权限的数据库列表，如果该命令是在未指定authorizedDatabases选项或设置为true的情况下运行的。listDatabases privilege action, users can run the listDatabases command to return a list of databases for which the user has the find action privilege.listDatabases权限操作，则用户可以运行listDatabases命令返回用户具有find操作权限的数据库列表。Apply this action to database or collection resources.将此操作应用于数据库或集合资源。
insert
User can perform the following commands and their equivalent methods:用户可以执行以下命令及其等效方法：
Required for the output portion of the 当输出到集合时，mapReduce command and db.collection.mapReduce() helper method when outputting to a collection.mapReduce命令的输出部分和db.collection.mapReduce()助手方法需要。
Required for the 在使用aggregate command and db.collection.aggregate() helper method when using the $out or $merge pipeline operator.$out或$merge管道运算符时，aggregate命令和db.collection.aggregate()助手方法需要。
Required for the 与update and findAndModify commands and equivalent helper methods when used with the upsert option.upsert选项一起使用时，update和findAndModify命令以及等效的助手方法都需要。
Required on the destination collection for the following commands and their helper methods:以下命令及其帮助程序方法在目标集合上是必需的：
Apply this action to database or collection resources.将此操作应用于数据库或集合资源。
remove
User can perform the 用户可以执行delete command and equivalent helper method.delete命令和等效的helper方法。
Required for the write portion of the findAndModify command and db.collection.findAndModify() method.findAndModify命令和db.collection.findAndModify()方法的写入部分需要。
Required for the 在输出到集合时指定替换操作时，mapReduce command and db.collection.mapReduce() helper method when you specify the replace action when outputting to a collection.mapReduce命令和db.collection.mapReduce()助手方法需要。
Required for the 在使用aggregate command and db.collection.aggregate() helper method when using the $out pipeline operator.$out管道运算符时，aggregate命令和db.collection.aggregate()助手方法需要。
Apply this action to database or collection resources.将此操作应用于数据库或集合资源。
update
User can perform the 用户可以执行update command and equivalent helper methods.update命令和等效的助手方法。
Required for the 在不指定mapReduce command and db.collection.mapReduce() helper method when outputting to a collection without specifying the replace action.replace操作的情况下输出到集合时，mapReduce命令和db.collection.mapReduce()助手方法需要。
Required for the findAndModify command and db.collection.findAndModify() helper method.findAndModify命令和db.collection.findAndModify()助手方法所需。
Apply this action to database or collection resources.将此操作应用于数据库或集合资源。
bypassDocumentValidation
Users can bypass document validation on commands and methods that support the 用户可以在支持bypassDocumentValidation option. bypassDocumentValidation选项的命令和方法上绕过文档验证。The following commands and their equivalent methods support bypassing document validation:以下命令及其等效方法支持绕过文档验证：
Apply this action to database or collection resources.将此操作应用于数据库或集合资源。
useUUID
User can execute the following commands using a UUID as if it were a namespace:用户可以像使用命名空间一样使用UUID执行以下命令：
For example, this privilege authorizes a user to run the following command which executes a 例如，此权限授权用户运行以下命令，该命令对具有给定UUID的集合执行find command on a collection with the given UUID. find命令。In order to be successful, this operation also requires that the user is authorized to execute the 为了成功，此操作还需要授权用户在与给定UUID对应的集合命名空间上执行find command on the collection namespace corresponding to the given UUID.find命令。
db.runCommand({find: UUID("123e4567-e89b-12d3-a456-426655440000")})
For more information on collection UUIDs, see Collections.有关集合UUID的更多信息，请参阅集合。
Apply this action to the 将此操作应用于cluster resource.cluster资源。
changeCustomData
User can change the custom information of any user in the given database. Apply this action to database resources.用户可以更改给定数据库中任何用户的自定义信息。将此操作应用于数据库资源。
changeOwnCustomData
Users can change their own custom information. Apply this action to database resources. 用户可以更改自己的自定义信息。将此操作应用于数据库资源。See also Change Your Password and Custom Data.另请参见更改密码和自定义数据。
changeOwnPassword
Users can change their own passwords. 用户可以更改自己的密码。Apply this action to database resources. 将此操作应用于数据库资源。See also Change Your Password and Custom Data.另请参见更改密码和自定义数据。
changePassword
User can change the password of any user in the given database. 用户可以更改给定数据库中任何用户的密码。Apply this action to database resources.将此操作应用于数据库资源。
createCollection
User can perform the 用户可以执行db.createCollection() method. db.createCollection()方法。Apply this action to database or collection resources.将此操作应用于数据库或集合资源。
createIndex
Provides access to the 提供对db.collection.createIndex() method and the createIndexes command. db.collection.createIndex()方法和createIndexes命令的访问。Apply this action to database or collection resources.将此操作应用于数据库或集合资源。
createRole
User can create new roles in the given database. 用户可以在给定的数据库中创建新角色。Apply this action to database resources.将此操作应用于数据库资源。
createUser
User can create new users in the given database. 用户可以在给定的数据库中创建新用户。Apply this action to database resources.将此操作应用于数据库资源。
dropCollection
User can perform the 用户可以执行db.collection.drop() method. db.collection.drop()方法。Apply this action to database or collection resources.将此操作应用于数据库或集合资源。
dropRole
User can delete any role from the given database. 用户可以从给定数据库中删除任何角色。Apply this action to database resources.将此操作应用于数据库资源。
dropUser
User can remove any user from the given database. 用户可以从给定数据库中删除任何用户。Apply this action to database resources.将此操作应用于数据库资源。
enableProfiler
User can perform the db.setProfilingLevel() method. Apply this action to database resources.将此操作应用于数据库资源。
grantRole
User can grant any role in the database to any user from any database in the system. 用户可以从系统中的任何数据库向任何用户授予数据库中的任何角色。Apply this action to database resources.将此操作应用于数据库资源。
killCursors
Starting in MongoDB 4.2, users can always kill their own cursors, regardless of whether the users have the privilege to 从MongoDB 4.2开始，用户总是可以杀死自己的游标，而不管用户是否拥有killCursors. killCursors的权限。As such, the 因此，killCursors privilege has no effect in MongoDB 4.2+.killCursors权限在MongoDB 4.2+中无效。
In MongoDB 3.6.3 through MongoDB 4.0.x, users require 在MongoDB 3.6.3到MongoDB 4.0x中，当启用访问控制时，用户需要killCursors privilege to kill their own curors when access control is enabled. killCursors权限来杀死自己的curors。Cursors are associated with the users at the time of cursor creation. 游标在创建游标时与用户关联。Apply this action to collection resources.将此操作应用于集合资源。
killAnyCursor
User can kill any cursor, even cursors created by other users. 用户可以杀死任何游标，甚至是其他用户创建的游标。Apply this action to collection resources.将此操作应用于集合资源。
planCacheIndexFilter
User can run the 用户可以运行planCacheClearFilters, planCacheListFilters, and planCacheSetFilter commands. planCacheClearFilters、planCacheListFilters和planCacheSetFilter命令。Apply the 将planCacheIndexFilter action to collection resources.planCacheIndexFilter操作应用于集合资源。
revokeRole
User can remove any role from any user from any database in the system. 用户可以从系统中的任何数据库中删除任何用户的任何角色。Apply this action to database resources.将此操作应用于数据库资源。
setAuthenticationRestriction
User can specify the authenticationRestrictions field in the 运行以下命令时，用户可以在user document when running the following commands:user文档中指定authenticationRestrictions字段：
User can specify the 运行以下命令时，用户可以在authenticationRestrictions field in the role document when running the following commands:role文档中指定authenticationRestrictions字段：
The following built-in roles grant this privilege:以下内置角色授予此权限：
userAdmin role provides this privilege on the database that the role is assigned.userAdmin角色在分配给该角色的数据库上提供此权限。userAdminAnyDatabase role provides this privilege on all databases.userAdminAnyDatabase角色为所有数据库提供此权限。Transitively, the 通过转换，restore and root roles also provide this privilege.restore和root角色也提供此权限。
Apply this action to database resources.将此操作应用于数据库资源。
setFeatureCompatibilityVersion
User can run the 用户可以运行setFeatureCompatibilityVersion command. setFeatureCompatibilityVersion命令。Apply this action to the 将此操作应用于cluster resource.cluster资源。
unlock
User can perform the 用户可以执行db.fsyncUnlock() method. db.fsyncUnlock()方法。Apply this action to the 将此操作应用于cluster resource.cluster资源。
authSchemaUpgrade
User can perform the 用户可以执行authSchemaUpgrade command. authSchemaUpgrade命令。Apply this action to the 将此操作应用于cluster resource.cluster资源。
cleanupOrphaned
User can perform the 用户可以执行cleanupOrphaned command. cleanupOrphaned命令。Apply this action to the 将此操作应用于cluster resource.cluster资源。
cpuProfiler
User can enable and use the CPU profiler. 用户可以启用并使用CPU探查器。Apply this action to the 将此操作应用于群集资源。cluster resource.
inprog
User can use the 用户可以使用db.currentOp() method to return information on pending and active operations. db.currentOp()方法返回有关挂起和活动操作的信息。Apply this action to the 将此操作应用于cluster resource.cluster资源。
invalidateUserCache
Provides access to the 提供对invalidateUserCache command. invalidateUserCache命令的访问。Apply this action to the 将此操作应用于cluster resource.cluster资源。
killop
User can perform the 用户可以执行db.killOp() method. db.killOp()方法。Apply this action to the 将此操作应用于cluster resource.cluster资源。
planCacheRead
User can run the following operations:用户可以运行以下操作：
$planCacheStatsApply this action to database or collection resources.将此操作应用于数据库或集合资源。
planCacheWrite
User can perform the 用户可以执行planCacheClear command and the PlanCache.clear() and PlanCache.clearPlansByQuery() methods. planCacheClear命令以及PlanCache.clear()和PlanCache.clearPlansByQuery()方法。Apply this action to database or collection resources.将此操作应用于数据库或集合资源。
changeStream
User with 具有特定集合、特定数据库中的所有非changeStream and find on the specific collection, all non-system collections in a specifc database, or all non-system collections across all databases can open change stream cursor for that resource.system集合或所有数据库中的全部非系统集合的changeStream和find的用户可以打开该资源的变更流游标。
appendOplogNote
User can append notes to the oplog. Apply this action to the 用户可以向oplog添加注释。将此操作应用于cluster resource.cluster资源。
replSetConfigure
User can configure a replica set. 用户可以配置副本集。Apply this action to the 将此操作应用于cluster resource.cluster资源。
replSetGetConfig
User can view a replica set's configuration. 用户可以查看副本集的配置。Provides access to the 提供对replSetGetConfig command and rs.conf() helper method.replSetGetConfig命令和rs.conf()助手方法的访问。
Apply this action to the 将此操作应用于cluster resource.cluster资源。
replSetGetStatus
User can perform the 用户可以执行replSetGetStatus command. replSetGetStatus命令。Apply this action to the 将此操作应用于cluster resource.cluster资源。
replSetHeartbeat
User can perform the deprecated 用户可以执行不推荐的replSetHeartbeat command. replSetHeartbeat命令。Apply this action to the 将此操作应用于cluster resource.cluster资源。
replSetStateChange
User can change the state of a replica set through the 用户可以通过replSetFreeze, replSetMaintenance, replSetStepDown, and replSetSyncFrom commands. replSetFreeze、replSetMaintenance、replSetStepDown和replSetSyncFrom命令更改副本集的状态。Apply this action to the 将此操作应用于cluster resource.cluster资源。
addShard
User can perform the 用户可以执行addShard command. addShard命令。Apply this action to the 将此操作应用于cluster resource.cluster资源。
clearJumboFlag
Available starting in 4.2.3 and 4.0.15从4.2.3和4.0.15开始提供
Required to clear a chunk's jumbo flag using the 需要使用clearJumboFlag command. clearJumboFlag命令清除块的jumbo标志。Apply this action to database or collection resources.将此操作应用于数据库或集合资源。
Included in the 包含在clusterManager built-in role.clusterManager内置角色中。
enableSharding
The action can apply to either:该措施可适用于以下任一情况：
| |
Starting in version 4.2.2, 4.0.14, 3.6.16
|
|
refineCollectionShardKey
Provides privileges to refine the shard key for a sharded collection; i.e. run the 提供为分片集合优化分片键的权限；即，运行refineCollectionShardKey command. refineCollectionShardKey命令。Apply this action to database or collection resource.将此操作应用于数据库或集合资源。
Included in the 包含在clusterManager built-in role.clusterManager内置角色中。
New in version 4.4.在版本4.4中新增。
flushRouterConfig
User can perform the 用户可以执行flushRouterConfig command. flushRouterConfig命令。Apply this action to the 将此操作应用于cluster resource.cluster资源。
getShardMap
User can perform the 用户可以执行getShardMap command. getShardMap命令。Apply this action to the 将此操作应用于cluster resource.cluster资源。
getShardVersion
User can perform the 用户可以执行getShardVersion command. getShardVersion命令。Apply this action to database resources.将此操作应用于数据库资源。
listShards
User can perform the 用户可以执行listShards command. listShards命令。Apply this action to the 将此操作应用于cluster resource.cluster资源。
moveChunk
User can perform the 用户可以执行moveChunk command. moveChunk命令。In addition, user can perform the 此外，用户可以执行movePrimary command provided that the privilege is applied to an appropriate database resource. movePrimary命令，前提是将权限应用于适当的数据库资源。Apply this action to database or collection resources.将此操作应用于数据库或集合资源。
removeShard
User can perform the 用户可以执行removeShard command. removeShard命令。Apply this action to the 将此操作应用于cluster resource.cluster资源。
shardingState
User can perform the 用户可以执行shardingState command. shardingState命令。Apply this action to the 将此操作应用于cluster resource.cluster资源。
splitVector
User can perform the 用户可以执行splitVector command. splitVector命令。Apply this action to database or collection resources.将此操作应用于数据库或集合资源。
applicationMessage
User can perform the 用户可以执行logApplicationMessage command. logApplicationMessage命令。Apply this action to the 将此操作应用于cluster resource.cluster资源。
closeAllDatabases
User can perform the deprecated 用户可以执行不推荐的closeAllDatabases command. closeAllDatabases命令。Apply this action to the 将此操作应用于cluster resource.cluster资源。
collMod
User can perform the 用户可以执行collMod command. collMod命令。Apply this action to database or collection resources.将此操作应用于数据库或集合资源。
compact
User can perform the 用户可以执行compact command. compact（压缩）命令。Apply this action to database or collection resources.将此操作应用于数据库或集合资源。
connPoolSync
User can perform the 用户可以执行connPoolSync command. connPoolSync命令。Apply this action to the 将此操作应用于cluster resource.cluster资源。
convertToCapped
User can perform the 用户可以执行convertToCapped command. convertToCapped命令。Apply this action to database or collection resources.将此操作应用于数据库或集合资源。
dropConnections
User can perform the 用户可以执行dropConnections command. dropConnections命令。Apply this action to the 将此操作应用于cluster resource.cluster资源。
dropDatabase
User can perform the 用户可以执行dropDatabase command. dropDatabase命令。Apply this action to database resources.将此操作应用于数据库资源。
dropIndex
User can perform the 用户可以执行dropIndexes command. dropIndexes命令。Apply this action to database or collection resources.将此操作应用于数据库或集合资源。
forceUUID
User can create a collection with a user-defined collection UUID using the 用户可以使用applyOps command.applyOps命令创建具有用户定义的集合UUID的集合。
Apply this action to the 将此操作应用于cluster resource.cluster资源。
fsync
User can perform the 用户可以执行fsync command. fsync命令。Apply this action to the 将此操作应用于cluster resource.cluster资源。
getDefaultRWConcern
User can issue the administrative 用户可以发出管理getDefaultRWConcern command. getDefaultRWConcern命令。Apply this action to the 将此操作应用于cluster resource.cluster资源。
getParameter
User can perform the 用户可以执行getParameter command. getParameter命令。Apply this action to the 将此操作应用于cluster resource.cluster资源。
hostInfo
Provides information about the server the MongoDB instance runs on. 提供有关运行MongoDB实例的服务器的信息。Apply this action to the 将此操作应用于cluster resource.cluster资源。
oidReset
Required to reset the 5 byte random string that is used in the ObjectID.需要重置ObjectID中使用的5字节随机字符串。
logRotate
User can perform the 用户可以执行logRotate command. logRotate命令。Apply this action to the 将此操作应用于cluster resource.cluster资源。
reIndex
User can perform the 用户可以执行reIndex command. reIndex命令。Apply this action to database or collection resources.将此操作应用于数据库或集合资源。
renameCollectionSameDB
Allows the user to rename collections on the current database using the 允许用户使用renameCollection command. renameCollection命令重命名当前数据库上的集合。Apply this action to database resources.将此操作应用于数据库资源。
Additionally, the user must either have 此外，用户必须在源集合上具有find on the source collection or not have find on the destination collection.find功能，或者在目标集合上没有find功能。
If a collection with the new name already exists, the user must also have the 如果已存在具有新名称的集合，则用户还必须对目标集合执行dropCollection action on the destination collection.dropCollection操作。
rotateCertificates
User can perform the 用户可以执行rotateCertificates command command. rotateCertificates命令。Apply this action to the 将此操作应用于cluster resource.cluster资源。
setDefaultRWConcern
User can issue the administrative 用户可以发出管理setDefaultRWConcern command. setDefaultRWConcern命令。Apply this action to the 将此操作应用于cluster resource.cluster资源。
setParameter
User can perform the 用户可以执行setParameter command. setParameter命令。Apply this action to the 将此操作应用于cluster resource.cluster资源。
impersonate
User can perform the 用户可以使用killAllSessionsByPattern command with users and roles pattern. users和roles模式执行killAllSessionsByPattern命令。Apply this action to the 将此操作应用于cluster resource.cluster资源。
To run 要运行killAllSessionsByPattern command, users must also have killAnySession privileges on the cluster resource.killAllSessionsByPattern命令，用户还必须对群集资源具有killAnySession权限。
listSessions
User can perform the 用户可以对所有用户或指定用户执行$listSessions operation or $listLocalSessions operation for all users or specified user(s). $listSessions操作或$listLocalSessions操作。Apply this action to the 将此操作应用于cluster resource.cluster资源。
killAnySession
User can perform the 用户可以执行killAllSessions and the killAllSessionsByPattern command. killAllSessions和killAllSessionsByPattern命令。Apply this action to the 将此操作应用于cluster resource.cluster资源。
checkFreeMonitoringStatus
User with this action on the 对cluster resource can check the status of Free Monitoring.cluster资源执行此操作的用户可以检查空闲监视的状态。
New in version 4.0.在版本4.0中新增。
setFreeMonitoring
User with this action on the 对cluster resource can enable or disable Free Monitoring.cluster资源执行此操作的用户可以启用或禁用空闲监视。
New in version 4.0.在版本4.0中新增。
collStats
User can perform the 用户可以执行collStats command. collStats命令。Apply this action to database or collection resources.将此操作应用于数据库或集合资源。
connPoolStats
User can perform the 用户可以执行connPoolStats command. connPoolStats命令。Apply this action to the 将此操作应用于cluster resource.cluster资源。
cursorInfo
User can perform the 用户可以执行cursorInfo command. cursorInfo命令。Apply this action to the 将此操作应用于cluster resource.cluster资源。
dbHash
User can perform the 用户可以执行dbHash command. dbHash命令。Apply this action to database or collection resources.将此操作应用于数据库或集合资源。
dbStats
User can perform the 用户可以执行dbStats command. dbStats命令。Apply this action to database resources.将此操作应用于数据库资源。
getCmdLineOpts
User can perform the 用户可以执行getCmdLineOpts command. getCmdLineOpts命令。Apply this action to the 将此操作应用于cluster resource.cluster资源。
getLog
User can perform the 用户可以执行getLog command. getLog命令。Apply this action to the 将此操作应用于cluster resource.cluster资源。
indexStats
User can perform the 用户可以执行indexStats command. indexStats命令。Apply this action to database or collection resources.将此操作应用于数据库或集合资源。
Changed in version 3.0.在版本3.0中更改。
indexStats command.indexStats命令。
listDatabases
User can perform the 用户可以执行listDatabases command. listDatabases命令。Apply this action to the 将此操作应用于cluster resource.cluster资源。
listDatabases privilege action, users can run the listDatabases command to return a list of databases for which the user has privileges (including databases for which the user has privileges on specific collections) if the command is run with authorizedDatabases option unspecified or set to true.listDatabases权限操作，则如果在未指定authorizedDatabases选项或将其设置为true的情况下运行该命令，则用户可以运行listDatabases命令以返回用户具有权限的数据库列表（包括用户对特定集合具有权限的数据集）。listDatabases privilege action, users can run the listDatabases command to return a list of databases for which the user has the find action privilege if the command is run with authorizedDatabases option unspecified or set to true.listDatabases权限操作，则用户可以运行listDatabases命令以返回用户具有find操作权限的数据库列表，如果该命令是在未指定authorizedDatabases选项或设置为true的情况下运行的。listDatabases privilege action, users can run the listDatabases command to return a list of databases for which the user has the find action privilege.listDatabases权限操作，则用户可以运行listDatabases命令返回用户具有find操作权限的数据库列表。listCollections
User can perform the 用户可以执行listCollections command. listCollections命令。Apply this action to database resources.将此操作应用于数据库资源。
Starting in version 4.0, user without the required privilege can run the 从版本4.0开始，没有所需权限的用户可以运行listCollections command with bothauthorizedCollections and nameOnly options set to true. listCollections命令，同时将authorizedCollections和nameOnly选项设置为true。In this case, the command returns just the name and type of the collection(s) to which the user has privileges.在这种情况下，该命令只返回用户有权限访问的集合的名称和类型。
listIndexes
User can perform the 用户可以执行listIndexes command. listIndexes命令。Apply this action to database or collection resources.将此操作应用于数据库或集合资源。
netstat
User can perform the 用户可以执行netstat command. netstat命令。Apply this action to the 将此操作应用于cluster resource.cluster资源。
serverStatus
User can perform the 用户可以执行serverStatus command. serverStatus命令。Apply this action to the 将此操作应用于cluster resource.cluster资源。
validate
User can perform the 用户可以执行validate and validateDBMetadata commands. validate和validateDBMetadata命令。Apply this action to database or collection resources.将此操作应用于数据库或集合资源。
anyAction
Allows any action on a resource. 允许对资源执行任何操作。Do not assign this action unless it is absolutely necessary.除非绝对必要，否则不要分配此操作。